denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

testing: Add scenario that uses IKE-specific interface IDs

Browse Source
This commit is contained in:
Tobias Brunner
2019-04-04 09:36:38 +02:00
parent 14e999c8d5
commit 072de7c150
10 changed files with 244 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
testing/tests/route-based/net2net-xfrmi-ike/description.txt
+18
View File
@@ -0,0 +1,18 @@
One connection with two CHILD_SAs between the hosts and subnet behind the
gateways <b>moon</b> and <b>sun</b>, respectively, are set up using XFRM
interfaces.
<p/>
The gateways use <b>route-based forwarding</b> with <b>XFRM interfaces</b>, with
firewall rules to allow traffic to pass. Both peers use connection-defined
interface IDs so all CHILD_SAs share the same XFRM interface. The IKE daemon
does not install routes for CHILD_SAs with outbound interface ID, so routes for
the target subnets are installed statically or via updown events.
<p/>
Both gateways use separate interfaces for in- and outbound traffic (which is
completely optional and mainly for testing purposes, a single interface will
usually be enough). Gateway <b>moon</b> creates them before initiating the
connection, while gateway <b>sun</b> dynamically creates the interfaces via
ike-updown event using the passed unique generated interface IDs.
<p/>
Clients <b>alice</b> and <b>venus</b> behind gateway <b>moon</b> ping client
<b>bob</b> located behind gateway <b>sun</b>.